/*     */ package com.zimbra.cs.account.krb5;
/*     */ 
/*     */ import com.zimbra.common.util.Log;
/*     */ import com.zimbra.common.util.ZimbraLog;
/*     */ import java.io.IOException;
/*     */ import java.io.PrintStream;
/*     */ import java.security.PrivilegedActionException;
/*     */ import java.security.PrivilegedExceptionAction;
/*     */ import java.util.HashMap;
/*     */ import java.util.Hashtable;
/*     */ import java.util.Map;
/*     */ import javax.naming.NamingEnumeration;
/*     */ import javax.naming.directory.DirContext;
/*     */ import javax.naming.directory.InitialDirContext;
/*     */ import javax.naming.directory.SearchControls;
/*     */ import javax.security.auth.Subject;
/*     */ import javax.security.auth.callback.Callback;
/*     */ import javax.security.auth.callback.CallbackHandler;
/*     */ import javax.security.auth.callback.PasswordCallback;
/*     */ import javax.security.auth.callback.UnsupportedCallbackException;
/*     */ import javax.security.auth.login.AppConfigurationEntry;
/*     */ import javax.security.auth.login.AppConfigurationEntry.LoginModuleControlFlag;
/*     */ import javax.security.auth.login.Configuration;
/*     */ import javax.security.auth.login.LoginContext;
/*     */ import javax.security.auth.login.LoginException;
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ public class Krb5Login
/*     */ {
/*     */   public static void verifyPassword(String principal, String password)
/*     */     throws LoginException
/*     */   {
/*  49 */     LoginContext lc = null;
/*     */     try {
/*  51 */       lc = withPassword(principal, password);
/*  52 */       lc.login(); return;
/*     */     } finally {
/*  54 */       if (lc != null) {
/*     */         try {
/*  56 */           lc.logout();
/*     */         } catch (LoginException le) {
/*  58 */           ZimbraLog.account.warn("krb5 logout failed", le);
/*     */         }
/*     */       }
/*     */     }
/*     */   }
/*     */   
/*     */   public static void performAs(String principal, String keytab, PrivilegedExceptionAction action) throws PrivilegedActionException, LoginException {
/*  65 */     LoginContext lc = null;
/*     */     try
/*     */     {
/*  68 */       lc = withKeyTab(principal, keytab);
/*  69 */       lc.login();
/*     */       
/*     */ 
/*  72 */       Subject.doAs(lc.getSubject(), action); return;
/*     */     }
/*     */     finally {
/*  75 */       if (lc != null) {
/*     */         try {
/*  77 */           lc.logout();
/*     */         } catch (LoginException le) {
/*  79 */           ZimbraLog.account.warn("krb5 logout failed", le);
/*     */         }
/*     */       }
/*     */     }
/*     */   }
/*     */   
/*  85 */   private static String S_CONFIG_NAME = "krb5";
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   public static LoginContext withKeyTab(String principal, String keytab)
/*     */     throws LoginException
/*     */   {
/* 120 */     Krb5Config kc = Krb5Config.getInstance();
/*     */     
/* 122 */     kc.setPrincipal(principal);
/* 123 */     kc.setKeyTab(keytab);
/* 124 */     kc.setStoreKey(true);
/* 125 */     kc.setDoNotPrompt(true);
/* 126 */     kc.setUseTicketCache(true);
/* 127 */     Configuration dc = new DynamicConfiguration(S_CONFIG_NAME, new AppConfigurationEntry[] { kc });
/* 128 */     return new LoginContext(S_CONFIG_NAME, null, null, dc);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   public static LoginContext withTicketCache(String cache)
/*     */     throws LoginException
/*     */   {
/* 150 */     Krb5Config kc = Krb5Config.getInstance();
/*     */     
/* 152 */     if (cache != null) {
/* 153 */       kc.setTicketCache(cache);
/*     */     } else {
/* 155 */       kc.setUseTicketCache(true);
/*     */     }
/* 157 */     Configuration dc = new DynamicConfiguration(S_CONFIG_NAME, new AppConfigurationEntry[] { kc });
/* 158 */     return new LoginContext(S_CONFIG_NAME, null, null, dc);
/*     */   }
/*     */   
/*     */   public static LoginContext withPassword(String name, String password)
/*     */     throws LoginException
/*     */   {
/* 164 */     Krb5Config kc = Krb5Config.getInstance();
/* 165 */     kc.setPrincipal(name);
/* 166 */     kc.setUseTicketCache(false);
/* 167 */     kc.setStoreKey(false);
/* 168 */     Configuration dc = new DynamicConfiguration(S_CONFIG_NAME, new AppConfigurationEntry[] { kc });
/* 169 */     CallbackHandler handler = new CallbackHandler() {
/*     */       public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
/* 171 */         for (Callback callback : callbacks) {
/* 172 */           if ((callback instanceof PasswordCallback)) {
/* 173 */             PasswordCallback pc = (PasswordCallback)callback;
/* 174 */             pc.setPassword(this.val$password.toCharArray());
/*     */           }
/*     */         }
/*     */       }
/* 178 */     };
/* 179 */     return new LoginContext(S_CONFIG_NAME, null, handler, dc);
/*     */   }
/*     */   
/*     */   static class DynamicConfiguration extends Configuration
/*     */   {
/*     */     private String mName;
/*     */     private AppConfigurationEntry[] mEntry;
/*     */     
/*     */     DynamicConfiguration(String name, AppConfigurationEntry[] entry) {
/* 188 */       this.mName = name;
/* 189 */       this.mEntry = entry;
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */     public AppConfigurationEntry[] getAppConfigurationEntry(String name)
/*     */     {
/* 198 */       return name.equals(this.mName) ? this.mEntry : null;
/*     */     }
/*     */     
/*     */     public void refresh() {}
/*     */   }
/*     */   
/*     */   public static class Krb5Config extends AppConfigurationEntry
/*     */   {
/*     */     private Map<String, String> mOptions;
/*     */     
/*     */     private Krb5Config(String loginModuleName, AppConfigurationEntry.LoginModuleControlFlag controlFlag, Map<String, ?> options) {
/* 209 */       super(controlFlag, options);
/*     */     }
/*     */     
/*     */ 
/* 213 */     public static final AppConfigurationEntry.LoginModuleControlFlag DEFAULT_CONTROL_FLAG = AppConfigurationEntry.LoginModuleControlFlag.REQUIRED;
/*     */     
/*     */     private static final String DEFAULT_LOGIN_MODULE_NAME = "com.sun.security.auth.module.Krb5LoginModule";
/*     */     
/*     */ 
/*     */     public static Krb5Config getInstance()
/*     */     {
/* 220 */       HashMap<String, String> options = new HashMap();
/* 221 */       Krb5Config kc = new Krb5Config("com.sun.security.auth.module.Krb5LoginModule", DEFAULT_CONTROL_FLAG, options);
/* 222 */       kc.mOptions = options;
/* 223 */       return kc;
/*     */     }
/*     */     
/* 226 */     public Krb5Config setDebug(boolean value) { this.mOptions.put("debug", value ? "true" : "false");return this; }
/* 227 */     public Krb5Config setDoNotPrompt(boolean value) { this.mOptions.put("doNotPrompt", value ? "true" : "false");return this; }
/* 228 */     public Krb5Config setKeyTab(String filename) { this.mOptions.put("keyTab", filename);setUseKeyTab(true);return this; }
/* 229 */     public Krb5Config setPrincipal(String principal) { this.mOptions.put("principal", principal);return this; }
/* 230 */     public Krb5Config setStoreKey(boolean value) { this.mOptions.put("storeKey", value ? "true" : "false");return this; }
/* 231 */     public Krb5Config setTicketCache(String filename) { this.mOptions.put("ticketCache", filename);setUseTicketCache(true);return this; }
/* 232 */     public Krb5Config setUseKeyTab(boolean value) { this.mOptions.put("useKeyTab", value ? "true" : "false");return this; }
/* 233 */     public Krb5Config setUseTicketCache(boolean value) { this.mOptions.put("useTicketCache", value ? "true" : "false");return this;
/*     */     }
/*     */   }
/*     */   
/*     */   static class DummyAction implements PrivilegedExceptionAction {
/*     */     String mArg;
/*     */     
/* 240 */     DummyAction(String arg) { this.mArg = arg; }
/*     */     
/*     */     public Object run() throws Exception
/*     */     {
/* 244 */       System.out.println("arg is " + this.mArg);
/* 245 */       throw new Exception("exception thrown from run");
/*     */     }
/*     */   }
/*     */   
/*     */   static class SearchAction
/*     */     implements PrivilegedExceptionAction
/*     */   {
/*     */     public Object run()
/*     */     {
/* 254 */       Hashtable env = new Hashtable(11);
/* 255 */       env.put("java.naming.factory.initial", "com.sun.jndi.ldap.LdapCtxFactory");
/*     */       
/*     */ 
/* 258 */       env.put("java.naming.provider.url", "ldap://localhost:389/");
/* 259 */       env.put("java.naming.security.authentication", "GSSAPI");
/* 260 */       env.put("javax.security.sasl.qop", "auth-conf");
/*     */       
/* 262 */       DirContext ctx = null;
/*     */       try
/*     */       {
/* 265 */         ctx = new InitialDirContext(env);
/*     */         
/* 267 */         SearchControls ctls = new SearchControls();
/* 268 */         ctls.setReturningAttributes(new String[] { "displayName", "mail", "description" });
/*     */         
/*     */ 
/* 271 */         NamingEnumeration answer = ctx.search("", "(cn=*)", ctls);
/*     */         
/*     */ 
/* 274 */         return answer;
/*     */       }
/*     */       catch (Exception e)
/*     */       {
/* 278 */         e.printStackTrace();
/*     */       }
/*     */       finally
/*     */       {
/* 282 */         if (ctx != null) {
/*     */           try {
/* 284 */             ctx.close();
/*     */           }
/*     */           catch (Exception closeProblem) {
/* 287 */             System.err.println("error closing Context - " + closeProblem.getMessage());
/*     */           }
/*     */         }
/*     */       }
/* 291 */       return null;
/*     */     }
/*     */   }
/*     */   
/*     */ 
/*     */   private static void testPerformAs()
/*     */   {
/*     */     try
/*     */     {
/* 300 */       performAs("ldap/phoebe.local@PHOEBE.LOCAL", "/etc/krb5.keytab", new SearchAction());
/*     */     } catch (LoginException le) {
/* 302 */       le.printStackTrace();
/*     */     } catch (PrivilegedActionException pae) {
/* 304 */       Exception e = pae.getException();
/* 305 */       System.out.println("exception msg is: " + e.getMessage());
/* 306 */       e.printStackTrace();
/*     */     }
/*     */   }
/*     */   
/*     */   public static void main(String[] arsg) throws LoginException
/*     */   {
/* 312 */     testPerformAs();
/*     */     
/* 314 */     System.out.println("succeeded");
/*     */   }
/*     */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/cs/account/krb5/Krb5Login.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */